Siebel CRM Deployment EUVD-2026-106689

Exploitation requires the attacker to already possess a low-privileged account with interactive logon to the host/infrastructure where Siebel CRM Deployment's Server Infrastructure component runs (AV:L/PR:L); there is no remote or unauthenticated path. Limiting factors: local access and valid low-privilege credentials are prerequisites, confining this to insiders or attackers who have already gained a foothold on the server; impact is restricted to confidentiality (data disclosure) with no integrity or availability effect. Affected deployments are Siebel CRM Deployment versions 17.0 through 26.9; patched releases from Oracle CPU October 2026 remove the condition.

This is a moderate-severity, local-access information-disclosure flaw in Oracle Siebel CRM Deployment (Server Infrastructure), and the signals point to a real-but-not-urgent priority rather than a top-tier emergency. The CVSS 3.1 base score of 5.5 reflects a local attack vector (AV:L) requiring an attacker to already have a low-privileged logon (PR:L) to the infrastructure where Siebel CRM Deployment executes, with low complexity (AC:L), no user interaction (UI:N), unchanged scope (S:U), and impact limited to confidentiality (C:H/I:N/A:N) - so the worst outcome is unauthorized read access to all Siebel-accessible data, not modification or disruption. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or available exploit code. Note a conflict in the metadata: the 'Authentication Bypass' tag contradicts the CVSS vector and description, which describe an already-authenticated low-privileged local user abusing access - not a bypass of authentication - so that tag appears mislabeled and should not drive prioritization. The requirement for prior local, authenticated access substantially limits real-world exploitability, making this a defense-in-depth patch rather than a perimeter emergency.

An attacker who already holds a low-privileged account on the server hosting Siebel CRM Deployment leverages the Server Infrastructure flaw to read sensitive data they should not be able to access, resulting in disclosure of critical Siebel CRM data. No user interaction is needed and the attack is low-complexity once local authenticated access is obtained. No public exploit code was identified at the time of analysis.